Privacy Policy for Field by Dextol

Effective date: August 31, 2026

Who we are

Field by Dextol (“Field”) is a field-sales CRM made by Dextol Inc (“Dextol”, “we”, “us”). A business (a “tenant”) signs up for Field, and its sales reps use the app to keep track of accounts, visits, orders, invoices, and tasks.

Three things up front: your company owns its CRM data, we never sell personal data, and we never use your data for advertising.

What we collect and how we use it

Sign-in details

When a rep creates an account we collect their name, email address, and which sign-in method they use (email and password, Google, or Microsoft). We use this to create the account, sign the rep in, and show their name to teammates inside their own company.

Data we receive from Google sign-in

If a rep signs in with Google, Google sends us their name, email address, and profile picture. We request only Google’s basic, non-sensitive scopes (openid, email, and profile) — nothing else from the Google account. We use the name and email address to authenticate the rep and identify them to teammates inside their own company. The profile picture is not displayed or used by Field. See Google user data below for our commitments about this data.

CRM records your team enters

Reps enter business accounts, visit notes, orders, invoices, and tasks — by typing or by speaking a voice note. We store this data so the app can do its job: showing your team its accounts, schedules, and sales history. This data belongs to your company and is visible only inside your company’s workspace.

Voice notes

When a rep records a voice note, we send the content to an AI provider (OpenAI or Anthropic) to turn it into a draft — for example, a draft visit note or order. The rep always reviews and confirms the draft before anything is saved. Nothing is stored in your CRM without that confirmation.

Speech recognition on mobile

Some parts of the mobile apps turn speech into text using the speech recognition service built into the device rather than sending the recording to us. This applies when a rep dictates into a form field and when a rep talks to the in-app assistant. On most Android phones that built-in service is provided by Google, and on iPhone it is provided by Apple; in either case the audio is handled by the device maker under that company’s own privacy policy, and it may be processed on the device or on that company’s servers depending on the phone’s settings. We receive only the resulting text, never the audio, on these paths.

The separate voice-note recorder described above works differently: that audio goes to our own servers for transcription and is discarded once the transcript comes back.

Photos reps attach

A rep can photograph a shelf or display and attach it to an account. Those photos are stored in private file storage inside your company’s workspace, visible only to your own team, and they are your company’s CRM data on the same terms as the records above. Nothing is uploaded until the rep chooses the photo, and we do not read a rep’s camera roll — only the images they pick or take for that purpose.

Location

While a rep is using the route planner, the app reads the device’s location to plan a driving route and find nearby businesses. Location is used live, in the moment — we do not track location in the background and we do not build a history of where a rep has been. In the Android app the rep asks for it explicitly: the first read happens only when they tap the locate control on the map, and the permission covers foreground use only. Once they have allowed it, the map shows their position while the route planner is open. The position moves the map to where they are standing, and a route is then planned from the part of the map they are looking at. We never store a rep’s location: it is not written to your company’s records, to file storage, or to our logs.

Map and place data

When reps search for businesses on the map, we look up place details (names, addresses, coordinates) through Google Maps Platform. Snapshots of lead places found this way are kept for at most 30 days, in line with Google Maps Platform terms, unless the rep saves the business as a CRM account — at which point it becomes your company’s CRM data.

Google user data

Data we receive from Google sign-in is used only to authenticate you and identify you inside your company’s workspace, and the profile picture is not used at all. We never share it, sell it, transfer it to third parties, or use it for advertising, and we never use it to train AI models.

Field’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers we rely on

We use a small number of providers to run Field. They process data on our behalf, only as needed to provide the service:

• Supabase — database, authentication, and file storage. This is where your CRM data and account information live.
• Vercel — hosting and the servers that run the app. Like most hosting providers, it keeps standard technical logs (such as IP addresses) to run and secure the service.
• Google Maps Platform — place search, address lookups, and route computation for the map and route planner.
• OpenAI and Anthropic — turning voice notes into drafts. We send only the content needed to produce the draft.
• The speech recognition service built into the phone (Google on most Android devices, Apple on iPhone) — used for in-app dictation and for talking to the assistant, as described above. This one is not a provider acting on our behalf: the audio goes from the phone to the device maker directly, under that company’s privacy policy, and never reaches us.

We do not sell data to anyone, and no provider is allowed to use your data for its own advertising.

Data retention and deletion

• Your company’s CRM data is kept for as long as your company uses Field. Your company owns it.
• A tenant admin can request export or deletion of their company’s data at any time by emailing privacy@dextol.ai.
• Any rep can delete their own account, without asking an admin, from the account menu inside the app. A rep who no longer has the app installed can request the same by email. See Delete your account for the steps and for exactly what is removed.
• When a rep’s account is deleted, we remove the rep’s identity — their name, email address, and sign-in identity — along with their voice notes and saved views. Business records the rep created (such as orders and invoices) remain with the company that owns them, and no longer carry the rep’s name or email address. Accounts the rep looked after are handed to a manager at the same company.
• Lead place snapshots from Google Maps expire automatically after at most 30 days.

How we protect your data

In plain terms:

• All traffic between your device and Field is encrypted (HTTPS), and data is encrypted where it is stored.
• Every database request is checked against access rules tied to your company, so one company can never read another company’s records.
• Sign-in is handled by established identity providers (Google, Microsoft) or securely stored passwords — we never see your Google or Microsoft password.
• Access to production systems is limited to the small Dextol team, and secret keys are never stored in the app that runs on your device.

Children

Field is a business tool and is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

If we change this policy, we will post the new version at this address with a new effective date. For significant changes, we will also notify tenant admins by email before the change takes effect.

Contact

Dextol Inc
Email: privacy@dextol.ai